Issue Mail Server Certificate Conflict Despite Correct Assignment (SNI Error)

[savo]

Server operating system version

Ubuntu 22.04.5 LTS

Plesk version and microupdate number

Plesk Obsidian 18.0.71 Update #2

Hello,

I have a critical issue with SSL certificate assignment on my Plesk mail server. The server is presenting the wrong certificate for incoming email connections, which makes automatic configuration and client connections impossible. I am confident that this is an SNI error where the server-wide default certificate is overriding domain-level assignments.

Infrastructure:

• Web Hosting: CloudPanel server
• Email Services: Plesk server
• Mail Gateway: Proxmox Mail Gateway (PMG)
• DNS: IONOS
• Plesk Plugin: Plesk Premium Email is installed.

Error Details:

• Domain 1 (DOMAIN1.com): The email account works correctly. Browser access to https://mail.domain1.com shows the correct certificate.
• Domain 2 (DOMAIN2.com): When trying to configure an email account, clients receive the error "Certificate name mismatch" or "Unable to connect to IMAP server". Browser access to https://mail.domain2.com incorrectly shows the certificate for DOMAIN1.com.

Steps Taken:

• I have separate Sectigo wildcard certificates for both domains, which have been imported into Plesk and assigned to the respective domains in Websites & Domains > [Domain] > Mail Settings. This has not fixed the error.
• All necessary ports (993, 465) are open and reachable in the Plesk firewall.
• Attempts to create a combined multi-domain certificate failed because the main domain A-records (DOMAIN1.com and DOMAIN2.com) point to the CloudPanel server, blocking Plesk's validation.
• Important: I used an SSL diagnostics tool that reported a "Certificate name mismatch" for mail.DOMAIN2.com and showed the DOMAIN1.com certificate.

Please assist me in correctly assigning the certificate on the mail server for these domains.

I have attached some print screen from the SSL configuration pages on PLESK.

Thank you very much for yiour support in advance.

Cheers!

 

[Martin Dias]

From what I can see, you texting the web port for the SSL on mail. That won't give you correct results.
Checking the mail port on the IP and domain you provided in screenshots seems that the SSL is correctly provided:

$ echo "QUIT" | openssl s_client -connect <redacted>:465 -servername mail.<redacted>.com 2>&1 |grep subject
subject=CN = *.<redacted>.com
$ echo "01 LOGOUT" | openssl s_client -connect <redacted>:993 -servername mail.<redacted>.com 2>&1 |grep subject
subject=CN = *.<redacted>.com

So if you're using the correct ports, it should work on a mail client with the current setup.

 

[savo]

Hi Martin, thank you very much for this point.
I've checked it and the ports are correct set up on email clients.
I attached a print screen below, and as you can see I got the error message, that the IMAP Server is still not available.

 

[Martin Dias]

Ok, I caught the wrong domain on my 1st reply:

$ echo "01 LOGOUT" | openssl s_client -connect 212.132.109.245:993 -servername mail.tv-eberbach.de 2>&1
CONNECTED(00000003)
4017145F30750000:error:0A000126:SSL routines:ssl3_read_n:unexpected eof while reading:../ssl/record/rec_layer_s3.c:316:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 328 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

This should fix it:

https://support.plesk.com/hc/en-us/articles/12387614382743-The-default-certificate-is-used-for-IMAP-connection-when-the-Plesk-Premium-Mail-is-installed